🔒 Script not skipping disabled users when performing the checks

[little fable]

@unreal grove

Python help channel opened

Remember to:

• Ask your Python question, not if you can ask or if there's an expert who can help.
• Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
• Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.

[unreal grove]

I have a script that performs some checks and I need it to skip current aws disabeld users.
I did try with the following but it seems that it is not skipping the disabeld users

code is attached in the file

I have a script that performs some checks and I need it to skip current aws disabeld users.
I did try with the following but it seems that it is not skipping the disabeld users

I need the script to be able to skip disabled users when performing teh checks

code is attached in the file

def lambda_handler(event, context):

    paginator = iam.get_paginator('list_users')
    page = paginator.paginate()
    csv_file = [["UserName", "CreationDate", "LastConsoleLogin", "DisabledDate", "MFA Disabled"]]
    users_disabled = False  # This flag will track if any users were disabled
    for page_user in page:
        users = page_user['Users']
        sort_users = sorted(users, key=lambda user: user['UserName'])
        for user in sort_users:
            username = user['UserName']
            groups = iam.list_groups_for_user(UserName=username)['Groups']
            group_name = [group['GroupName'] for group in groups]
            dry_run = False

            # Checking if users have MFA enabled
            checking_mfa(username, group_name, dry_run, csv_file)

    # An email will be sent if either users have been disabled and sends the link with the csv file or not
    if not users_disabled:
        goodemail()
        print("no users to disabled")
    else:
        print("users to disabled yes")
        emailtobesent(csv_file)

my code

def checking_mfa(username, group_name, dry_run, csv_file):

    mfa_status = iam.list_mfa_devices(UserName=username)['MFADevices']
    disabled_user = iam.get_user(UserName=username)['User']
    creation_date = disabled_user['CreateDate'].replace(tzinfo=None)
    # Let's perform some dry run
    if dry_run:
        print(f"Dry run for {username}:")
        print(f"\tMFA Status: {len(mfa_status)}")
        print("")

    # Veryifing MFA status
    else:
        #
        if 'UserStatus' in disabled_user and (not 'UserStatus' in disabled_user or disabled_user['UserStatus'] == 'Active':
            if len(mfa_status) == 0 and 'specificgroup' not in group_name:
                
                if creation_date >= today - timedelta(days=7):
                    print(f"{username} is a new user")
                else:
                    # No MFA = account is disabled due to non-compliance
                    # ss
                    iam.delete_login_profile(UserName=username, NewPasswordRequired=False)
                    print(f"User {username} has been disabled d")

                    # Let us send all the info into a csv file
                    disabled_date = today.strftime('%d/%m/%Y')               # Adding date user was disabled
                    last_login = disabled_user.get("PasswordLastUsed")
                    if last_login:
                        last_login = last_login.strftime('%d/%m/%Y')
                    else:
                        last_login = "N/A"
                    mfa_disabled = 'Yes'
                    # Let's append all the outcome into csv file
                    csv_file.append([username, creation_date.strftime('%d/%m/%Y'), last_login, disabled_date, mfa_disabled])

                    users_disabled = True       # Set flag to indicate that user account was disabled

        else:
            
            return f"Users are compiled with IAM policy"

my 2 parte of the code

[timid bloom]

!paste for what its worth, you can upload the code to the pastebin and share the link

[little fable]

Pasting large amounts of code

If your code is too long to fit in a codeblock in Discord, you can paste your code here:
https://paste.pythondiscord.com/

After pasting your code, save it by clicking the Paste! button in the bottom left, or by pressing CTRL + S. After doing that, you will be navigated to the new paste's page. Copy the URL and post it here so others can see it.

[unreal grove]

here it is

https://paste.pythondiscord.com/PQ3HAHO4VLNWHMXSNBWN4UAUIM

[timid bloom]

And what exactly is the problem you are having?

[unreal grove]

it does not skipp current users whose aws accounts are already disabled.
So it needs to performs some mfa checks but with this peace of code below it does not work and says that users are compiled, when I know some are not.
Script runs weekly and the main point here is to avoid having the same users whose accounts are disabled in the csv file, so that is why I want to skip users who are already disabled

if 'UserStatus' in disabled_user and (not 'UserStatus' in disabled_user or disabled_user['UserStatus']) == 'Active':

[timid bloom]

Hmmm

That if statement looks a bit off

'UserStatus' in disabled_user 
and
(
    not 'UserStatus' in disabled_user
    or
    disabled_user['UserStatus']
)
== 'Active'

I think it could be simplified

[unreal grove]

something like this

with that if statement it does not show users who are disabled, only those that are compiled with policy however it does not disable users who have no mfa

[little fable]

Python help channel closed

This help channel has been closed and it's no longer possible to send messages here. If your question wasn't answered, feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.